Skip to main content
Version: 7.3

Grant permissions for the OneDrive archive

Introduction​

Granting permissions for the OneDrive archive allows contentACCESS to authenticate and connect to the required Microsoft environment using a modern and more secure authentication method.

This page describes how to configure the required API permissions in the registered application, grant admin consent, and assign the client certificate and client secret needed for authentication.

Configure API permissions​

  1. Navigate to your registered application (Azure Active Directory → App registration → Owned applications → registered application, for example Test_app → open the application by clicking on its title). On the application details page, click API permissions in the left menu. When the configured permissions page loads, click + Add permission and select the requested API.

  2. On the Request API permissions → Microsoft APIs tab, select Microsoft Graph. Permissions from Microsoft Graph are required to access the OneDrive archive, enabling the capability to read the OneDrive sites/accounts of users.

  3. After selecting the option from the list, choose the Application permissions box, where the available permissions from this category are shown.

  4. Locate the following permissions:

    • Files.ReadWrite.All (read and write files in all site collections) from the Files option.
    • Sites.Read.All and Sites.ReadWrite.All (read and write items in all site collections) from the Sites option.

    Then click Add permissions.

  5. After the permissions have been assigned to the application, the administrator must grant consent for these permissions. Click Grant admin consent for "TENANTNAME".

Assign the client certificate and client secret​

  1. Once the permissions are assigned to the application and admin consent is granted, the client access certificate needs to be assigned to the application. Click Certificates & secrets in the left menu. On the certificate management screen, click Upload certificate (Certificates tab). Browse to the client certificate you want to use and upload it. It can be a self-signed certificate or an already existing one. A PowerShell script for creating a self-signed certificate can be downloaded here.

  2. Add a new client secret by clicking + Next client secret. This is necessary for some jobs and client applications (for example, Test_client secret).

After the configuration is done, copy the client secret shown in the Get client secret dialog box to a secure location so that you can refer to it later. The client secret is required when configuring certain contentACCESS models with modern authentication, such as Email archive, SharePoint archive, Teams archive, GDPR Exchange, and Exchange connection.

info

Note: The App registration uses a client secret that has a limited lifetime (usually one year). It is important to maintain this information: every year, a new client secret needs to be generated for the App registration. The updated client secret must then be applied in all affected contentACCESS configurations.